npm

vps-new-manager @0.1.4

Vulnerability report · Last retrieved from osv.dev July 8, 2026 at 7:23 PM UTC

Malicious

OSV ID

MAL-2026-7014

Ecosystem

npm

Summary

The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent. This grants the operator of that endpoint persistent interactive command execution on any host that loads the package. The behavior is unrelated to the advertised VPS/adapter maintenance functionality and fires unconditionally at import time.

Source: amazon-inspector (b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.